yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] HunteronX:
They'd probably do it to prevent unauthorised flashing of the phone for good.

BUT if this did happen, it would mean that we'd have a copy of a bootloader to edit, and maybe fool SEUS into flashing our own one (by replacing the old one), with all of the boot checks removed.
[XPERIA X10 Android Development] mayank.1love:
Thanks for correcting me.

If they don't ever need to update the boot loader then it'll be of no use to us but if by any chance they have implemented it in SEUS for future use we can definitely use it.

I'll just decompile everything I can in SEUS and let you all know if I find anything.

I think the main jars are in SEUS plugins directory. You can easily decompile class files with "DJ Java Decompiler".
[XPERIA X10 Android Development] biktor_gj:
I don't think SEUS is able to write the bootloader more than x10flash app can. Bootloader is security locked, and it doesn't allow to be overwritten. My best guess is you need EMMA or other service center tool to be able to overwrite it, after turning it into activation mode or something like that. Also, the certificate doesn't seem to be hardcoded on the loader itself, it seems it's on another area (possibly the trimm area), and the bootloader checks against it.

About the recovery & chroot:

Still working on it, had some things to do and haven't been able to work on it as much as I'd like, and still having some troubles killing everything prior to restarting without a hard reset. And when I lock the system partition to force it not to start the service manager and the system server I only have a chance to do it right or I have to reflash, reroot, copy everything back and do the next test, so I'm facing half an hour stopped for each try... Will post back when there is more to say :P
[XPERIA X10 Android Development] n-ki:
Is it a viable alternative to replace the cert with one of our own ? I don't mind not being able to revert
[XPERIA X10 Android Development] kr3w1337:
Some time ago, you guys we're looking at getting a developer device, just a thought but something tells me that wouldn't that device be less locked down than the production one?
[XPERIA X10 Android Development] biktor_gj:
nah digital signatures everywhere. If you touch the ta the phone won't come up again until you restore it back... oh if things were that easy... ;)

@chroot: almost there! rild crashes if enabled on init, and when you disable it the system boots chrooted, but after a minute or two it restarts....I think I still need to delete a lot of crap from the libraries and fake the original init better (edit: hmmm... or kill it's pid since it should be pid #1)(service manager is a critical service and as such it forces init to reboot when it doesn't come up right)... anyone knows which libraries are ABSOLUTELY ESSENTIAL for INIT?

... but hey! I'm getting close :P

edit2: ok, killing init wasn't that good idea, or at least didn't work as expected... :P (stupid son of a ....)
[XPERIA X10 Android Development] zdzihu:
Have you seen init.rc from MotoFrenzy custom rom? Maybe there's a clue. I'm messing with that one at the moment but no joy so far (I guess I should try stock 1.6 instead of CM6 :P ). By the way, at which point do you start your code? drm.sh or earlier?
[XPERIA X10 Android Development] biktor_gj:
nope i havent seen it...could you paste it here (im on the phone now)? My dirty hack makes it boot all the way to the main screen. I have also been able to set ro.secure to 0. The way Ive done it is respectful with whatever is installed and doesnt break data. My problem is with the binaries executed from init, that mess with the rest of the system until it crashes and then reboots. The chroot is in the drm script for now, but doesnt matter where it stays, the problem are the rest of the services, that need to be faked before that kicks in...
[XPERIA X10 Android Development] lqbweb:
ey, just one question.... all the previous work which was being doing patching some stuffs for the watchdog and so on, is it useless with your method? I mean.... when you get it started for 1 minute or so, is it working completely all? camera, sound, etc.?
[XPERIA X10 Android Development] biktor_gj:
Well everything I had time to try works, and should work no matter what, because I'm using original kernel and original ramdisk. When init starts, I break it apart and start a new one, using the system partition as the root directory. That way, we can build our own roms and make them boot without failing the S1 Loader's check for boot.prop :)

Everything done so far on usbloader & goroh's kernel modifications are very useful, and the hack I'm doing will be much more useful once kernel's issues have been worked out, since with usbloader and chrooted image we can boot whatever we want while making the loader think everything is beautiful :)

Oh, and we can have a recovery method that doesn't require reflashing, rerooting, and starting over again and again everytime something gets wrong in the filesystem, or at least that's the idea.

The problem: after chrooting, initial init process seems to have some kind of problem that reverts the system partition to /system, then some services start to crash, and it finally ends up rebooting the phone. I think it's something to do with the servicemanager, but still not working as I want it to...
[XPERIA X10 Android Development] biktor_gj:
Relax people, and please don't start again filling this thread with non-dev related stuff. We've asked it a lot of times. When it'll be ready, it will be published.

@zdzihu: I'm still testing some things, tonight I'll send you a copy of everything, working or not working, so you can take a look. Maybe you can help me out a bit ;)
[XPERIA X10 Android Development] biktor_gj:
Sony Ericsson has its own USBLoader! Take a look (last source code for the x10):

http://developer.sonyericsson.com/cws/download/1/823/547/1278490567/X10_Donut_100622_01.tar.bz2

Then, inside the tar file, go to this folder:

/home/biktor/Descargas/X10_Donut_100622_01/esheep_linux/LINUX/android/vendor/semc-proprietary/bootable/kdump_usb

Maybe we can do something useful with this...:)

Regards!
[XPERIA X10 Android Development] mayank.1love:
Have you developed the usbloader from another source?

I have seen the usbloader source code in X10 source code in vendor directory.

http://developer.sonyericsson.com/cws/download/1/823/547/1278490567/X10_Donut_100622_01.tar.bz2

This is the proprietary SEMC usbloader.

Hope this helps in some way.
[XPERIA X10 Android Development] HunteronX:
I hope so...
[XPERIA X10 Android Development] biktor_gj:
hhhhhmmmm... if I read the code right they are using usbloader for crashdump collection and booting. Ive seen the sysinit for the scorpon cpu there so it may be able to do a cold boot just fine. only problem is all qualcomm proprietary files are missing on the package... (take a look at the makefiles)

@Goroh_kun: do you think we could have a way to read and write to the nand from usbloader? I activated the init functions and declared our micron nand, and usbloader seems to boot fine but don't know how to build a function to read from it...
[XPERIA X10 Android Development] mayank.1love:
I think I got complete bootloader/usbloader/nandwrite source code.

http://android.git.kernel.org/

Legacy Bootloader

http://android.git.kernel.org/?p=platform/bootable/bootloader/legacy.git;a=tree

DiskInstaller

http://android.git.kernel.org/?p=platform/bootable/diskinstaller.git;a=tree

Recovery

http://android.git.kernel.org/?p=platform/bootable/recovery.git;a=tree

http://android.git.kernel.org/?p=platform/recovery.git;a=tree

Hope this helps.
[XPERIA X10 Android Development] biktor_gj:
NOTICE: If you're not a developer DO NOT USE THIS. IT WILL CRASH YOUR SYSTEM PARTITION FORCING YOU TO REFLASH AND LOOSE EVERYTHING YOU HAVE ON THE PHONE.

Ok, given the fact that my main computers' installation is falling apart and doesn't let me cross compile a simple binary, I think I'm going to leave here the scripts unfinished and reinstall it all.

If anyone has some time please cross compile a binary which just sleeps, something like:

int main(int argc, char *argv[])
{
printf ("start the fake");
while (1)
{
sleep(9999);
}
return 0;
}

Then modify prepare.sh so it copies that binary as /system/bin/servicemanager so the process doesn't exit and thus init doesn't reboot. Notice I have done some more changes to the script and haven't even tested them since not even adb is working now on my pc, so there might be some bugs I'm not aware of, apart from the fact that it doesn't work ;)

Everything on the package is quite self explainatory, simply dump everything on a SD card (I'd advise to make a copy of the full sdcard just in case)

Check it out, and see if you can make it work, but don't execute it as is unless you want to see a thing reboot all the time ;P

Regards!
[XPERIA X10 Android Development] zdzihu:
Thanks biktor_gj, I am definitely going to try this one tonight.

My attempts with own script and CM6 (by jerpelea) fail - currently in the boot loop, spitting megabytes of logs in my face. I'm really short on time now, but trying to figure out what's going on there.

As for servicemanager, I remember reading somewhere that you can't really get rid of it without other services failing afterwards

(haven't tried yet - we shall see :D).
[XPERIA X10 Android Development] biktor_gj:
The thing is there are two inits, the one before the chroot, and the other one after chroot has been done.

The only servicemanager that needs to be faked is the one prior to the chroot, so that first Init doesn't crash. The second init (after chroot) needs to execute servicemanager fine. And indeed it does, but as the other one keeps crashing first init makes the phone reboot, even if everything seems to be running correctly. Or at least that's the idea I get.

If you want I can take a look at the logcat & dmesg from your attempts with cyanogen, feel free to paste them on pastebin :)

regards
[XPERIA X10 Android Development] ardf69:
If you see in init.rc you find

service servicemanager /system/bin/servicemanager

user system

critical

onrestart restart zygote

onrestart restart media

the critical option makes the X10 reboot. You must don't terminate the fake servicemanager.

Ciao Angelo
[XPERIA X10 Android Development] zdzihu:
@biktor_gj:

I don't have full logs with me (at work atm), but got a small piece to look into.

There are usual minor errors with audio and bluetooth, no big deal, but the real baddie is here:

http://pastebin.com/iE0Se6Z5

Luckily I'm not banned from google :D so I've found this:

http://mdzlog.alcor.net/2009/08/22/android-emancipation/

Would that be it?

Cheers
[XPERIA X10 Android Development] biktor_gj:
If you are still using all the application data from the 1.6 system it would make perfect sense. Maybe after copying the froyo image you should delete everything on /data and then do the reboot. Also permissions change so it may even be trying to read something it doesn't have rights to...

About the servicemanager, I know its a critical service, and that's why I want to compile a program which would fake the real servicemanager and wouldn't ever exit but just stay there idle, so the thing doesn't crash :)

I'm messing this much with the binaries and the system partition just because of the S1 Loader and its check for /system/build.prop on boot. If you remove that file, the phone goes to recovery. If we use system as "/" and leave build.prop in there, it passes the bootloader check, and we can reuse it for our init scripts.
[XPERIA X10 Android Development] Bin4ry:
Here is fakeserver. Just build not tested cause i'm not home yet :)

Regards

Andreas
[XPERIA X10 Android Development] mattiL:
Hi

Isn't this a mistake ?

(to cp akmd2 twice, overwriting chmodded servicemanager)

#cmzn, adbd, rca_util etc

cp /sbin/* /system/sbin

busybox rm servicemanager

busybox cp akmd2 servicemanager

busybox chmod 755 servicemanager

busybox cp akmd2 servicemanager
[XPERIA X10 Android Development] biktor_gj:
Yepp it was, though it doesn't matter because it still had execution permissions, but that's part of the changes I didn't check twice ;) thanks for the advise!

EDIT: THANK YOU BIN4RY!

First issue solved, it doesn't reboot by itself. Though now I still need to get rid of some troubles of init.rc (duplicated services) that make the phone crash. Will post back when that's fixed. Tonight I'll post a second version of the scripts with the changes made
[XPERIA X10 Android Development] Bin4ry:
@Biktor:

Hmn okay i work now a little too an your script!

AND nice idea to use the drm script to **** this ***** ;) I know that it was your wish to find a vuln in DRM to get rooting ;) Now is the second chance to hijack drm ;)

HAHA ^^

Now i will go and reset my phone to test the scripts :) Letme know if you have smth new :) I'll do also

Regards

Andreas
[XPERIA X10 Android Development] Chewitt:
Out of interest are you guys working to get a standard 2.2 or a cyanmod 2.2 onto the handsets so i can get cracking on a special X10 theme for it?
[XPERIA X10 Android Development] biktor_gj:
What we're doing is the base, and at this time reuse SE's filesystem for simplicity purposes. You should be able to run whatever you want on top of it just by replacing some lines on the "prepare.sh" script and modifying init.rc :)

PS: It boots, gets to the homescreen, and almost works as expected. Except for a little trouble where it remounts again mtd system partition to /system and then crashes the system unless you chroot again... but hey, it doesn't reboot, and I'm listening to music on the chrooted install :)

Oh, and telephony works perfectly fine ;) I have to do something with mountd remounting system partition...

@Bin4ry: Who said DRM was a useless piece of crap made only to prevent legal users from using drm protected stuff legally? Oh I love the irony... :P
[XPERIA X10 Android Development] Chewitt:
Cool, i think that most people will use cyan so i will start there.
[XPERIA X10 Android Development] Contrarian:
Being the same kernel, will it work on the mini or do we need to modify it. I suppose bin4ry will take care of this but I'm just curious

Hey if cyanogan works on HTC Dream I can't see why it won't run here

P.S We all appreciate the excellent work you guys are doing over here
[XPERIA X10 Android Development] Findee:
Has anyone seen this topic over on the i9000 forums?

http://xdaforums.com/showthread.php?t=765724

I just thought it might be useful in the development.
[XPERIA X10 Android Development] PheneoN:
Hi guys

Today i was playing around with SwiFTP (FTP server application for android) and saw the known folders in the root of the phone.

because i was curious what files where in does folder so i decide to look and came a cross this weird file (well weird to me)

Otacerts located in /etc/security/

http://rapidshare.com/files/416005526/otacerts.zip

I have no knowledge about cracking/hacking or something about coding, don't blame me for trying to help.
[XPERIA X10 Android Development] theeedy:
Well, this could be something.

It is encoded in base64, and definitely something like a Sony Ericsson Certificate.

I've attached the decoded certificate. Maybe someone can so "something" with it. :)

Edit:

The content:

Edit2:

It would be interesting what happens, if you alter or delete this file.

Could someone try this? Maybe then we know more about what this file is good for.

Edit3: Probably Over-The-Air-Update-Certificate, so ... not very useful for us,... i guess.
[XPERIA X10 Android Development] yetep:
I don't normally post here but its, to my knowledge, over the air certificates
[XPERIA X10 Android Development] Jugstah:
I would imagine given the name its the public key for OTA updates. To do anything the phone would want to accept you would need to have the private key. Unless however you were able to replace the public key with your own as someone suggested.
[XPERIA X10 Android Development] Zykatious:
Could you maybe give it an "authentic" ota using thright certificate key? Somehow rig an update server with your own Rom and use the right key? Just a thought mind, I'm no android hacker :)
[XPERIA X10 Android Development] mayank.1love:
Ser file decompilation

Just got something out of ser file that gets downloaded along with the three bin files while we update firmware using SEUS.

I treated the ser file as a class file and decompiled it and got the java code that also have "Sim Lock" parameters which can I think can help in unlocking X10.

I have uploaded the original ser file with decompiled java code here

http://hotfile.com/dl/66158673/92f3756/ser_crack.rar.html

If anyone can find anything interesting in it reply here.
[XPERIA X10 Android Development] MarylandCookie:
Hey mayank.1love, how good are your java skills?

Any chance you could look at the rest of seus?

I know there are a lot of plugins in the seus directory and was wondering if you could take a look at how seus decompiles/decrypts seus downloaded files so that once figured out maybe you could put a little (jar) file together for everyone to use to decompile/decrypt their seus downloaded files.

What do you think?
[XPERIA X10 Android Development] zdzihu:
Hi Biktor_gj,

Few questions if you don't mind :)

Which firmware are you on? I am on 026 generic and it seems mountd is fully deprecated in favour of vold.

Any particular reason to leave qmuxd running (didn't see it listed in your prepare.sh)?

And last but not least:

Have you tried chrooting into any external rom? If so, what was the outcome?

Thanks a million!
[XPERIA X10 Android Development] Cablekevin:
// Send loader
vS1.sendFile(aLoader);

vS1.openDataArea(DataArea.MISC_TA);

// Send App-SW
sendZipFile(vS1, aAppSW, vFilesToExcludeFromAPPSW);

// Send FSP
sendZipFile(vS1, aFSP, vFilesToExcludeFromFSP);

Those 2 pieces of code pulled my attention. - Have more decompiled java? :)
[XPERIA X10 Android Development] biktor_gj:
@zdzihu & bin4ry

Hi, sorry for not posting anything here for a few days, just got back to work today and I've been preparing some stuff..

I'm on .026 (even if I hate that stupid memory leak somewhere on the framework). When I said mountd I meant vold, but vold only works for the sdcard, so I though it was something on the init what was crashing and returning the system partition to it's place.

So I started over from scratch, and instead of making that mess of script I'm just using a small install script with a tar.gz'd package for the system partition. Still working on it since I have quite a few problems with the symlinks and permissions. I've done again the drm script and now it's a bit cleaner. I tested with one of goroh's bootimage and seems to work. I'm trying to get everything ready before releasing something here and have everyone yelling at me because it doesn't work fine :)

What's taking more time is the recovery application, which I thought would be easier, until I found out how it worked on the inside. I hope to get some time during the weekend to modify all the recovery application to be able to clear the dalvik cache, run adb as root, update from update.zip (even if it's just for the system partition by now), and some bits more here and there.

About the other roms, I tried with jerpelea's cm6, a generic froyo compiled by me with minimal stuff, and a random 1.6 rom I had laying around from my htc magic. The 1.6 got further than anything else on booting, but didn't get to boot completely. I need to have a solid base first to be able to really do something, otherwise I don't know if they are my scripts, SE's Init, or the rom itself what is crashing...
[XPERIA X10 Android Development] mayank.1love:
I'll try to decompile everything. If I get anything interesting (which I'll surely get cause everything interesting is in SEUS :) ) I'll share here.

Java code can be easily altered. As the jars in EMMA and SEUS are similar we can surely find something important. What I am targeting right now is skipping the EMMA login checks (if possible) and compile my own cooked version of SEUS/EMMA to do everything with custom ROMS and bootloaders. The functions inside EMMA jars for upgrading can be applied to SEUS for custom upgradation.

I'll try my best.

BTW the three bins for upgrading are at:-

http://ma3.extranet.sonyericsson.com/ns/common/1/file/791/277196791_xjzBnD68BkXbe5-9oSZvdZYK.bin

http://ma3.extranet.sonyericsson.com/ns/common/1/file/959/277508959_tnKxnx9xyPxx6k5sWnQ0mOFH.bin

http://ma3.extranet.sonyericsson.com/ns/common/1/file/395/277505395_sNUXV6NuijzxypOz7Es02rrN.bin

Some days ago the filenames were:-

277196791_xjzBnD68BkXbe5-9oSZvdZYK.bin

277435035_TkPj1YQTO1H18uFyphG0TF69.bin

277458179_nJfDsbyaW907KPzIPGx4id2-.bin

Can anyone good with encryption/hashing find out any relation of filenames with any known hashing technique.

For e.g.

http://ma3.extranet.sonyericsson.com/ns/common/1/file/791/277196791_xjzBnD68BkXbe5-9oSZvdZYK.bin

"xjzBnD68BkXbe5-9oSZvdZY" may be some kind of hash derived from "277196791"

Last three numbers of "277196791" is the directory on server (791) where the file is present.

If anyone got some clue about any hashing present, we can predict future firmware location on SE servers or can bruteforce the server with number and number-to-hash conversion script.

This is all I decompiled from Ser file, I'll try to decompile all other jars in SEUS.

We can surely implement some EMMA functions in SEUS.

aLoader grabbed my attention too, now just digging deep into java/jars/classes :-)
[XPERIA X10 Android Development] Bin4ry:
@Biktor:

Thats good news. You made more than me :P I have cleaned my system partition completely (except of necessary files). And altered the init. In the init i only chrooted into another prepared directory with foryo system and let the original init do its best. For now i'm hanging shortl after the bootanim.

I think that maybe we get it working. For now i'm unsure if my froyo system is corrupted or if there are some problems with the original system(btw. i don't let it boot because i altered the init so that it ONLY chroots :D ).

My hope is that i get it working and can make a multiboot :P

Maybe you can send me your progress so that i can take a look too. I have spare time tomorrow :D

Regards

Bin4ry
[XPERIA X10 Android Development] Bin4ry:
So i looked into you java file. It's quite interesting and i already decompiled whole SEUS and overlooked some files as it seems :P

Okay we have 2 interesting parts as i see :P

We have "customization" AND "activation". After a customization you have to do another activation. SO i think. if we get a customization flashed we can activate it again. We have this lines in Activation part :

if (vDoActivation)

{

// Verify that the dongle is present

secs.ensureDongleReady();

So maybe we can hook in here. I will try to compile something tomorrow :P

Regards

Bin4ry
[XPERIA X10 Android Development] JamesBarnes:
What are you using to decompile? My decompiler doesnt retrieve the method/variable names...